Illegal reflective access by org.simpleflatmapper.reflect.ObjectGetterFactory

[coffeeandicecream]

Hi,

I'm using SFM v8.2.3 with Spring JDBC and JDK 11, and I've started to see these "Illegal reflective access" warnings. Any recommendations? I believe this SFM version is the latest and is the appropriate version for JDK 11 accordning to the documentation. Am I missing something?

I'm only aware of special handling configured for UUID columns for read mappers. I don't think we're doing anything special or out of the box for handling date columns, I'd have to verify.

Example:

private final RowMapper<MyClass> rowMapper = JdbcTemplateMapperFactory.newInstance() .addGetterForType(UUID.class, (rs, index) -> UUIDUtils.getUUIDFromByteArray(rs.getBytes(index))) .newRowMapper(MyClass.class);

Warnings:

        | WARNING: An illegal reflective access operation has occurred
        | WARNING: Illegal reflective access by org.simpleflatmapper.reflect.ObjectGetterFactory (jar:file:/tf-appsec-vip.jar!/BOOT-INF/lib/sfm-reflect-8.2.3.jar!/) to field java.util.Date.gcal
        | WARNING: Please consider reporting this to the maintainers of org.simpleflatmapper.reflect.ObjectGetterFactory
        | WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
       | WARNING: All illegal access operations will be denied in a future release

      | WARNING: An illegal reflective access operation has occurred
       | WARNING: Illegal reflective access by org.simpleflatmapper.reflect.ObjectGetterFactory (jar:file:/tf-dataservice.jar!/BOOT-INF/lib/sfm-reflect-8.2.3.jar!/) to field java.util.UUID.serialVersionUID
       | WARNING: Please consider reporting this to the maintainers of org.simpleflatmapper.reflect.ObjectGetterFactory
      | WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
       | WARNING: All illegal access operations will be denied in a future release`

[arnaudroger]

I’ll have a look, are you using the jdk9 build or the regular one?

[coffeeandicecream]

Just saw your reply.

My local env/build process is using AdoptOpenJDK 11. The service is deployed as a docker container and it uses "openjdk:11-jre"

Running java -version in my local environment where I build the project, prints the following:

openjdk version "11.0.7" 2020-04-14 OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.7+10) Eclipse OpenJ9 VM AdoptOpenJDK (build openj9-0.20.0, JRE 11 Mac OS X amd64-64-Bit Compressed References 20200417_552 (JIT enabled, AOT enabled) OpenJ9 - 05fa2d361 OMR - d4365f371 JCL - 838028fc9d based on jdk-11.0.7+10)

[coffeeandicecream]

Sorry to bother, any recommendations on how to avoid this or the associated risk?

[arnaudroger]

I'm trying to reproduce, but gcal and serialVersionUID are static fields so it would not do anything about them.

the warning is triggered as far as I can tell when call setAccessible(true) on the Field.
with --illegal-access=deny it does not put out the warning but through an exception that the ObjectGetterFactory will swallow and return no Getter for that which will be fine there.

so if it works with --illegal-access=deny which sfm should be able to, then there is no risk.

could you also try running with --illegal-access=deny and put a breakpoint on java.lang.reflect.InaccessibleObjectException
it would be easier to see what is causing that if i had the stack trace.

[ipainchaud]

I also have the same issue and also was wondering if this was a real issue and if this would be resolved shortly:

java --version
openjdk 15.0.2 2021-01-19
OpenJDK Runtime Environment Corretto-15.0.2.7.1 (build 15.0.2+7)
OpenJDK 64-Bit Server VM Corretto-15.0.2.7.1 (build 15.0.2+7, mixed mode, sharing)

My Data Objects were generated by Lombok:

@Value
@ToString
@Builder
@AllArgsConstructor
@EqualsAndHashCode
public class AbcdClass {
    Integer intProp;
    String stringProp;
    LocalDateTime localDateTimeProp;
    Set<EfghClass> innerClasses;
}

The RowMapper used:

    private final RowMapper<AbcdClass> rowMapper = JdbcTemplateMapperFactory.newInstance().ignorePropertyNotFound().newRowMapper(AbcdClass.class);

The version of spring-boot used:

	id 'org.springframework.boot' version '2.4.2'

The version of sfm: 8.2.3
The version of asm: 9.1

Warning messages I get without the --illegal-access=deny:

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.simpleflatmapper.reflect.ObjectGetterFactory (file:/Users/xyz/.gradle/caches/modules-2/files-2.1/org.simpleflatmapper/sfm-reflect/8.2.3/c00114b680676ae86beca20707f9320aab7f0674/sfm-reflect-8.2.3.jar) to field java.time.LocalDateTime.serialVersionUID
WARNING: Please consider reporting this to the maintainers of org.simpleflatmapper.reflect.ObjectGetterFactory
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release

Error messages I get with the --illegal-access=deny:

Unable to make private java.io.File(java.lang.String,java.io.File) accessible: module java.base does not "opens java.io" to unnamed module @7e919698

Unable to make private java.io.File(java.lang.String,int) accessible: module java.base does not "opens java.io" to unnamed module @7e919698

Unable to make private synchronized void java.io.File.readObject(java.io.ObjectInputStream) throws java.io.IOException,java.lang.ClassNotFoundException accessible: module java.base does not "opens java.io" to unnamed module @7e919698

Unable to make private synchronized void java.io.File.writeObject(java.io.ObjectOutputStream) throws java.io.IOException accessible: module java.base does not "opens java.io" to unnamed module @7e919698

Unable to make final boolean java.io.File.isInvalid() accessible: module java.base does not "opens java.io" to unnamed module @7e919698

etc.

I hope this helps!

[gbanusi]

Same issue

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.simpleflatmapper.reflect.ObjectGetterFactory (file:.../org.simpleflatmapper/sfm-reflect/8.2.2/d0fbdac08fbde9336283c495432d14f4d12f9c91/sfm-reflect-8.2.2.jar) to field java.util.UUID.serialVersionUID
WARNING: Please consider reporting this to the maintainers of org.simpleflatmapper.reflect.ObjectGetterFactory
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release